Harden API key file loading

internal/app/secrets_env_windows.go

@@ -0,0 +1,11 @@
+//go:build windows
+
+package app
+
+import "os"
+
+// Windows access control is determined by ACLs rather than POSIX mode bits.
+func validateSecretDirectoryPrivacy(_ os.FileInfo) error { return nil }
+
+// Windows access control is determined by ACLs rather than POSIX mode bits.
+func validateSecretFilePrivacy(_ os.FileInfo) error { return nil }